hello, We’ve received an alert from this CVE that an instance of discourse is vulnerable to https://www.cve.org/CVERecord?id=CVE-2022-31096 It is said that the fix is in 2.9.0.beta6 but I’m unable to find and upgrade to that version. Is anyone else having this problem?

You can upgrade now and that commit will be applied. It’s not a critical security issue, so they didn’t bump the version to push it out.

You’re right, the patch is there: https://github.com/discourse/discourse/commit/115859964d6e3e92d6d933ffe8e1b330b12a3aca but there has not been any bump in version since :thinking:

We do a beta bump for a high severity CVE shortly after the fix is released, but we missed to do that for the last CVE (CVE-2022-31096). We released 2.9.0.beta6 last week (Thursday) so this should be resolved now. [이미지] 2.9.0.beta6: Whisper Improvements, Loading Splash Scree…

discourse 버전 2.9.0.beta6을 찾을 수 없음

제품 지원

Osama 7월 4, 2022, 8:49오전 9

고중도 CVE의 수정이 배포된 직후 베타 버전을 업데이트했지만, 지난 CVE(CVE-2022-31096)의 경우 이를 놓쳤습니다. 지난주(목요일)에 2.9.0.beta6를 배포했으므로 이제 이 문제가 해결되었을 것입니다.

글		댓글	조회수
Your Discourse installation is out of date. Click here to upgrade Self-hosting	1	395	12월 6, 2023
Do I need to upgrade to version 1.8.0.beta11? Product Support	22	2154	5월 7, 2017
Up to date with 2.6.0.beta1 Product Support	4	1171	8월 20, 2020
Discourse Upgrade Not Working Product Support	3	212	11월 5, 2024
Stable version upgrade to 2.4.0 Product Support	4	787	2월 27, 2020

discourse 버전 2.9.0.beta6을 찾을 수 없음

Related topics